CVE-2007-3236

published 2007-06-15

CVE-2007-3236: PHP remote file inclusion vulnerability in footer.php in the Horoscope 1.0 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in…

Priority P3 59 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

PHP remote file inclusion vulnerability in footer.php in the Horoscope 1.0 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
xoops	horoscope_module	—	—

Detection & IOCs extracted from sources · hover to see the quote

path modules/horoscope/footer.php↗

• → Detect HTTP requests targeting footer.php in the horoscope XOOPS module with a user-supplied URL in the xoopsConfig[root_path] parameter, indicating remote file inclusion attempt. ↗

• · The exploit references module version 2.0 in the title while the CVE describes version 1.0; both versions of the Horoscope module for XOOPS appear to be affected. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.